Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
abb18cc7dd7bc371fd36851cd9dae9e1_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
abb18cc7dd7bc371fd36851cd9dae9e1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
abb18cc7dd7bc371fd36851cd9dae9e1_JaffaCakes118.html
-
Size
67KB
-
MD5
abb18cc7dd7bc371fd36851cd9dae9e1
-
SHA1
cf12fd7a175575f4fca066f2967b69054cb7426f
-
SHA256
6ebebe51778226df93e77503404be3d19efa833e4ad61039f18f1926ec912426
-
SHA512
8dce25542af42b3ff784c7493f732230089cccec4b33ac5357b9bc688c37ebbe1a2b1ad34249838526e162551ce16fc0f69f2c857d6622d465ba572769348142
-
SSDEEP
768:Ji/gcMiR3sI2PDDnX0g6Ze6N/eIoTyXqwCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:Jd6GFT04en0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000ad123a5babdd032a72c2ce6d2b8de137db4cc342979f818e908dea2347b0acef000000000e80000000020000200000000468d6b5aa5d0c87613faf504208187f6751a1ec9e197018ec85c7bdac0c1f4b20000000c8343eee52107a2d3d983dc060df708cf1426d21df1030d421195f9f46d7d06840000000f8434fda805139c13510799b489fe913e87deb518e43bbacc566fdf2788c27e6a7d0da10e9f0e6e2d9e91cf4a3517715558248eeebc9744a0cac84d3600c860d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424564924" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1008becda7beda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9043761-2A9A-11EF-AB3F-D2DB9F9EC2A6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000ff2e00653bd8bf2564e6340b684bdc273eb6bb7669dbdcf47eed97afe759fe96000000000e8000000002000020000000765f03074828649f9f01eb9707fc30824798fe09a971b74aa1d3607423e711e590000000d544044c0a958e91567dd8e7dad94105711ee883964904ccbce0ac8fe5fc121a6bef933f7f08d20201f5bd56c622d8cb8b55dcbbcd76e7e6c43682ebcab0b6e58fcf6ba0b87136e19dcb16c45bf2a509369aca6ead5f11883e9dbdd6915101bb43b3f3a5432f0e0cca5edab5554457d98b70baaeaeea580a0a019c1c93a532e478854a442a0a79e1d16521dce4954c2c40000000daf56ef97161fe4f86eedca7e2e877f4e7a51d60522d6c71843d569b480434a4f3d470ddeb39ae684f08180991c431ed2e8a3899f16842f30b6c75c068937062 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2276 2208 iexplore.exe 28 PID 2208 wrote to memory of 2276 2208 iexplore.exe 28 PID 2208 wrote to memory of 2276 2208 iexplore.exe 28 PID 2208 wrote to memory of 2276 2208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abb18cc7dd7bc371fd36851cd9dae9e1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f7d9f2ec94fe3c28863060734930078
SHA1ac1c6904d1ece8d6ede19e161fad1e3aed6d2701
SHA2562793400beb9a6a35aff7d6e469776f08601c4cd019ce83bfaa1cd0e27c935901
SHA51287530056c251a435a70b6da3cbb00f813c75ef2d842031875276b8d2657326870f418d631acd80915d63bc9196d7d6e528e1f37a3d706d21251dbc18ed9a7735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594fdb326a25d3b9b5e57c422e619a644
SHA192f94daa603a544f44bf7952687acada4c7854a8
SHA25644623ef241faad9c6992cf341ce56545a42faac60b761359e23737f16be1a810
SHA512c9d977a10e17d49df4b37442a57666f544108bdcf84ac66c7074e28099d7041e54d7fec25949fc0fd2dbdd1bfdb73feda7fd61d4295b66402f0ba4c5e0edb02b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57bcb2711e8eb78f0238d11c120ede5e3
SHA164c90f9c084a707332125172f51297279064d87e
SHA256857535b5665eab9fdbe48bc7a47b68529cad524e6a4af7417d386404112f6065
SHA512a084ce4d4ed1d75548a5d06df289ba56789ec4d3e5364c798396ba8034a196056b7bd1e998da05b8f28b705d407081ca045d55b9d5149fed1188e2f93cda04da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca17a9661569006d2fcedb7849908993
SHA1b81c19102648644efeb7b72dbb571f50a7734121
SHA2567e3f1327cce57354c1c7df487098c54361ed02f35abb75490695c4399082f31d
SHA512a4e64111163dc986bd514a84d367f3f63060cfde084392d493dcf6b35c26170c5a21a0d942cbbd2ae5c631a5207eea7fb1221c705cb27e5c369ebf9095a96671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cd115a6a53e4061cb42c9f143b13f9c
SHA10d071b87768f55dea395a625408be5a4dab96bd6
SHA256d5d5f5e99acc4798b7c61fad22723acf60963d8c5e0fb198952fd49ae68e6105
SHA512fe9a86a9a1b8b3286e0e6b376fd3ec5d676d1dabaf6a117c369cad0326ad13ff29fa4a10047a2fb63a421a7f178d5ee31d91a723ea40a0a6019050d53466190f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9db0edec10b0d468c1f0f55665d0a20
SHA14bbbe6d75228584e163aae169f71339afa7fa51a
SHA2566e4f3c3c7913283ee268058174b0c9731cbf9cac6b4e1fd885fbf20e93c1b965
SHA512cc5fcb3ce37cc9435b27c2d0896cf7a5b2102140b761c43446facfa401e37f2013c768cb8b60809c7fd9746cefcfc4adfcc16361509b5aa72b95427923bc2811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f9537a32a09085a89e9c33a47e1fa6e
SHA1df0139e96934e0b6186f236a1bccea8922ce7129
SHA256dcb62eb3988f3644973d1cf49d39a47c92d5bfc5d16381ee7128bab39e463864
SHA51259fb100157cf9ec69feb77ddf868f87d83fe2bf9b86f9074629cfc6d1ce1d7ec42bdb6cdd0a9bcd2f81342fa485f6008722319f48577b9f769622ef3f1427246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538d694c5bacf8f65f45ed9b03fbea7fc
SHA157dc467920aeffb5626425a72d39f23dca74fa19
SHA2561b9c2156551703ebdbd3886576254a4cc492a7dcb450563c3696daeb3c077246
SHA51225279765bdebd4a3249a90cebe4ab75eb67a7f8e8a894d41a142d337da93355cf99fa6165af01e201311a7eebbc43e2b05aeff7f01bc78c71f54b07871244fe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d3762b57fc76c714a4ef30deb4e01f
SHA1065abb4c74c306a92f8d94c305794c8503373b46
SHA256084b6aee7edb93ac329343518c561fa53f6b78c8394c2422cd6556bac3e0041a
SHA512d2a27bd47039bd0d6dd5c9c228465f3cecb5b55954eacde990d071bfe2d49a8d6dfb75ccf0c0025cc5c2a1eed4a72891023f91c1061b88a6be65b12cfd171ca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b601b9f0e9647a85fb7249beb5bf129
SHA18cdb0a7c8b40c7e524353cf062553c1ced68702d
SHA256ce291133404f41d9ccdcd061bb2153240e80e05a82feca936bed612df2d11f68
SHA51224c5bfe0875946bc1577d812c1501e0a1039af394b3061f8fb182cf40947aef17ac532627061134fed388dc03b08c0d6b9fac4672d2a0a20af40969bbd5636bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a22c40bf92f1f97e2426e61fcd9a8f0
SHA1f2c8ecf291a6cf706514b80e712ddb2fafaf548e
SHA256890a46b62b471ff95a6d8f4d8e3f13c0b077a33c157c6e3cc8c0bacb9fb5ec9b
SHA5127f299e5169152ddb931c8eba841a2c85605ea58bf1b6819c04075437201a5c94fab2d1182d8c8602b6257f20e616ff54fd8f6cecfd96df182234d6abf99149e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fb40cd20c0c0189b65b2b3a08f6cf84
SHA1519175e979baa8f4df1cd364209b653b009292aa
SHA25640c61fa85fa7e2158b9bd6d275b1efb36196cf88f9f75c36988ecde19021c232
SHA5127ad160b2e9de2226e9c5270712112256d0f84953ce63dfeb5954bdb29ed3488fa12dfc952671b36263e46a38408baf551caa6db50c890b581379ec45ad674117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c26156aa53c4ad44c3052d8e294e429e
SHA1f5457b323be42976d81fe1e2ac558846163a6b99
SHA2568df604d0345d1523d3288c875293335bd0b702b84ed783c618ea62cddc364c17
SHA512fe6668ed5185f99fdcd569e6109ddca9fcfa16ef2f491525b98f02ba62e61c6454dd69ed1af597f026429829b05d9609d4286a472e94e21ead351b0071146237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b778beee6708c281d5d094454c09c21b
SHA1590ebf33e70b2646f126f1d7475956877b48326f
SHA256c7188052a9588557414fddcb5f7a7f6aac4d5ed91a5309a1b87be3a8b60dd417
SHA512053099d601dfd2f3e04fdda89349431a53c5c2791a1a771c39cee04243bfafde840677a0766668e402aeaf74ab448e14b9b9e04c0d7180b06b512352e59578a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9d3dc38d6cee94b88f8a9a4adb47266
SHA1465a1329f082b615be157f2a4450dd516459a5e6
SHA256dc9d0ef737049e5a2d7e81e64de7b4c117eed50c278d165cef85fe122b98c76f
SHA51205f3c6c3b62ab1d23b376d46099967f4171eef9ae893771d5a62956f5d5f1fd77f142d427149dbae6e9027f12b7541d08cc435643ce83ec1c44dc54941e7d1a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f543b7d864d55806ad6fe87b6e57b2d
SHA1b064b279c0cd7075a3c672162e6f3c351497e341
SHA2568b3b9258eeb0cdb79507b8369dc6f43ad1e6c9af7be8ce9fcc3ba26fe2f0e710
SHA512c222c0ed92bb57023e83b1ff14a980a194ce426dd5c9cff3ea92e8e93f4594733a3eb726b94de8dd165773b7e788c2abebe1feca0ec39f435fccabf727426238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cef765537df96ade63b43d2c70c1a5a1
SHA13ddd35fb15dc3c69916529897b8f8744ea98cf25
SHA2567227a8ff158489e669ac4401d9a9d15b7bed31833f64bc4796d199db08da0b2b
SHA512004eea97afa7ece9153ebdd9865ac2ff1118279016db74b80c784e8a05ad9333d09977c7d6cf14a6b90453eb73fb6acc1b4fe924697809ae1a6319d5058399f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523a8eb4507520fe1f9149535c6a03ccd
SHA1ae1ca79cdb7a6e5f0d40f6897c1b04525504be6e
SHA2568d595c20c44ab805a64928b63d117d5a09ed9987f71155b449230562e3870c10
SHA51238a12cd1da5951f581edc3e870d1a781a38fbde54cb837b4e5f053e85644032ec8c22282f84347c841fd33fa159ddc05db291c644cea5e032b2e6e41647b7b99
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b